Statement on Cyber Resilience Act: Impact on Research and Education in Informatics

Binzmühlestrasse 14 8050 Zurich, Switzerland +41 44 635 4354 [email protected] www.informatics-europe.org Statement on Cyber Resilience Act: Impact on Research and Education in Informatics Informatics Europe supports the goals of the Cyber Resilience Act (CRA), a European regulatory initiative, aiming at increasing the quality and security standards of IT products. This initiative is nearing its final legislative phase, but along with many in the Open-Source Community, Informatics Europe is concerned with certain aspects of its framing by the European Commission and Parliament. In particular, without seeking to entirely exclude Open Source from security liabilities, Informatics Europe emphasizes the need to protect the individual and academic contributors to Open Source from the liabilities. This is paramount to prevent unintentional disruptions while embracing the new regulation. Open Source serves various purposes, including supply chain components, research tools, and the foundation for small businesses. The CRA affects these diverse uses differently, and it is important to recognize that software is both a technical and cultural artifact with unique characteristics. Open Source encompasses a range of business models, from charging for software to offering services and support. Attempts to identify commercial aspects of Open Source should consider the diversity of business models and avoid unintended consequences for different approaches. Most Universities involved in Research and Education in Informatics, and even large foundations like the Linux Foundation or Apache Software Foundation are not software producers, have no direct governance over the OSS projects, and may not have resources dedicated to ensuring code compliance. They should therefore not be held liable in the first place. If they were liable, the impact on the willingness of developers to use these platforms and contribute to OSS development would be significant and negative. Informatics Europe thus recommends that the CRA excludes all activities before commercial software deployment and ensure that responsibility for CE marks (indicating compliance with EU regulations) lies with direct commercial beneficiaries of deployment rather than other actors. This approach aims to strike a balance between regulation and the preservation of Open-Source freedoms and diversity.